How-To: Unlock and Root the HP Slate 8 Pro

This is revision 1.5. It works on both currently available HP firmware releases,
1.00.05 and 1.00.08. If you upgrade from '05 to '08 you will need to re-root.

Both releases are Android 4.2 - if there's a 4.3, the method will change.

At a high level, the steps are:

- OEM unlock your bootloader using the Shield naked drivers developed by 1wayjohnny
- boot your device using a CWM originally developed for the Transformer 701 by Drgravy
- on rebooting the CWM, it will offer to root your system. Do so.
- install SuperSU or another SU manager.
- Done.

Prerequisites:

- Willingness to wipe your Slate 8's user memory - this willl happen during the process of unlocking, and, not by accident.
- Android SDK tools from Google
- Java (IIRC, the SDK is looking for 32 bit Java 1.6)
- 1wayjonny's "Naked USB Driver" from the Shield forum on XDA http://xdaforums.com/showthread.php?t=2386956
- Drgravy's Clockwork 6.0.3.7 for the TF 701 available at http://xdaforums.com/showthread.php?t=2524401
- a microSD card and a copy of the update.zip file from HP's website, to attempt a recovery if you hose your device.

I: Preparing ADB on the PC

Download and install the SDK tools. You don't need every single thing the SDK manager offers to fetch; just the minimum to get functioning ADB support, which is the platform tools package.

Put the ADB command set into your PATH variable. In Windows, do this by using the system settings tool, Advanced... Environmental Variables.. System Variables. Scroll down until you see 'PATH" click the Edit button and append the path to the directory with the ADB.EXE and FASTBOOT.EXE files in it.

In win 7, that path is C:\Users\username\AppData\Local\Android\android-sdk\platform-tools\

Next, find the .android environment folder on your computer. In win7, it is
C:\Users\username\.android

You need to create a adb_usb.ini file here that contains the vendor ID string for your Slate.

The value is
0x03F0

Reboot your PC and be sure that from a command prompt, typing adb start-server results in

* daemon not running. starting it now on port 5037 *
* daemon started successfully *

II Enabling ADB in Android

Go to your device and tap on the build number field 8 times (in System.. About Tablet)

That enables developer mode. In the new developer options menu that is now available, tick "enable USB debugging"

III Installing and Testing the Drivers to Talk to Your Device via ADB

Download and install the Naked driver.

Connect your Slate to your USB port. You should get an unknown device followed by a failure to install driver message. Right-click on the device and manually install the ADB composite driver from the Naked driver android_winusb.inf file, choosing the nvidia shield as your device. You will get a warning that the driver is unsigned.

Once the driver is installed, open a command prompt and type
adb devices

You should get

List of devices attached
CND34609YG device

IV Unlock the Bootloader

Now type

adb reboot-bootloader

Your device restarts. A screen shows up all black with white lettering; this screen is telling you your boot loader is locked

Go to device manager; you should have a new device without a driver.

Navigate to the Naked driver folder and manually install the driver from the android_apxusb.inf file.

(that is, not the file you installed the regular ADB driver using)

Install the Shield fastboot driver.

At the command prompt, type
fastboot -i 0x03F0 oem unlock

The display on your Slate should change, warning you that you're about to void the warranty and erase all data on your device.

Use the volume up and volume down key to navigate the menu that comes up on your slate and choose "unlock."

This will erase all data on your Slate, and reinstall existing /system apps. It will not remove /system apps you shouldn't have put there in the first place!

Let your device restart and rerun its setup routine.

V Rooting the device

Connect the USB cable to the fully booted device. Open a command prompt and navigate to the directory the Clockwork recovery is downloaded to.
type
adb reboot-bootloader

At the bootloader screen, use the volume down button to select "Fastboot Protocol" and press the power button once

Now, type

fastboot -i 0x03F0 boot recovery.img

The command prompt will tell you how long it took to download the recovery; the display will
tell you it is booting from the donwloaded image.

Give it a minute or two, and your device will boot into clockwork.

Choose reboot.

Clockwork will notice that you are not rooted, and offer to drop su into /system for you.

It will also offer to disable the onboard recovery system from updating. You probably don't want to do so until
- you've backed up the recovery partition
- you've decided to install Clockwork permanently.

V Reinstalling HP software using Clockwork

This is fairly simple to do. You need to have booted into Clockwork and to have a copy of one of the HP zip files that contains a full software update, available from HP.

Those HP files are flashable in clockwork with a little editing:

To get the recovery to install, I found I needed to edit the recovery script from HP a bit:

- unzip the recovery
- navigate to

\update\META-INF\com\google\android

Open the updater-script in a text editor

delete the first few lines:

assert(!less_than_int(1381289516, getprop("ro.build.date.utc")));
assert(getprop("ro.product.device") == "fig" ||
getprop("ro.build.product") == "fig");
assert(getprop("ro.product.name") == "kadota_w_a");

those values were not being retrieved and that stopped the update from flashing.

Save updater-script

Re-zip everything below \\update\

Verify that your zipfile is structured correctly, ie, at the top level you have
- meta-inf
- recovery
- system
- blob
- boot.img

You can then put your update.zip on an sdcard and navigate to it in Clockwork (only the volume up key works for navigation as of now) or get into the advanced menu in Clockwork and do an adb sideload.

boomboom, I'm in the same boat right now.

The possibilities are:
- figure out how to get the nvidia shield / note 7 boot and root image to work on our devices
- come up with a new exploit allowing root (keep looking for Cydia updates)
- try to force the recovery boot and reload the '05 firmware via recovery.

I was not able to get that to work this weekend and am now looking into linux boot a la the gnurou disks.

The 1.00.05 files are up on the HP site still, as a zip file at
http://h10025.www1.hp.com/ewfrf/wc/...en&cc=us&dlc=en&sw_lang=&product=6608624#N147

supposedly you can place that zip (be sure it's called update.zip) on an sdcard, power your device off, put the sdcard in, and power on while holding volume down.

In the menu that comes up, use the volume down button to highlight "recovery kernel" and click the power button to start recovery.

I was not able to get this technique to restore my device to '05 but hope others have better luck.

Part of my problem was not realizing that even though the recovery looks as if nothing is happening, if you leave it alone long enough, the device eventually restarts, implying that there may be a recovery process going on which is just impossible to monitor.

If that's true, the recovery is installing the update again regardless of what's on the card, though.

Take a look at the update in the first post. '08 is now rootable.

There is a CWR originally written by Drgravy for the TF701 which will boot the Slate 8 as well.

It's a fully functional CWR, lets you flash zips and the whole nine yards.

It also sees if you're not rooted and offers to fix it for you.

I borked my partition table completely. I just finished repairing it and getting the OS reinstalled. I'll detail that tomorrow, but if anyone is willing to share what a "stock" layout looks like, I'd love to see one.

Very short version: image the damaged internal memory. Repair gpt in linux. Reimage back to device. Assign correct names using gdisk. Reinstall OS using CWR.

the output from these commands would be great:

mount
cat /proc/mounts
cat /proc/partitions

and one other - this one requires grabbing a copy of a utility called gptfdisk and running it. (It's fdisk for gpt based disks; like fdisk, it does not commit changes without asking.)

http://dl.dropbox.com/u/64885133/gptfdisk.zip is where the file lives (originally compiled by meghd00t)

Copy gdisk to your device and make it executable

adb push gdisk /system/bin/gdisk
adb shell
# chmod 777 gdisk

invoke by
# gdisk /dev/block/mmcblk0

then

p for print

On a nexus 7, the output looks like this:

root@flo:/ # gdisk /dev/block/mmcblk0
gdisk /dev/block/mmcblk0
GPT fdisk (gdisk) version 0.8.4

Partition table scan:
MBR: protective
BSD: not present
APM: not present
GPT: present

Found valid GPT with protective MBR; using GPT.

Command (? for help): p
p
Disk /dev/block/mmcblk0: 60424192 sectors, 28.8 GiB
Logical sector size: 512 bytes
Disk identifier (GUID): 98101B32-BBE2-4BF2-A06E-2BB33D000C20
Partition table holds up to 32 entries
First usable sector is 34, last usable sector is 60424158
Partitions will be aligned on 2-sector boundaries
Total free space is 1526010 sectors (745.1 MiB)

Number Start (sector) End (sector) Size Code Name
1 131072 306143 85.5 MiB 0700 radio
2 393216 399359 3.0 MiB FFFF modemst1
3 399360 405503 3.0 MiB FFFF modemst2
4 524288 554287 14.6 MiB 8300 persist
5 655360 656919 780.0 KiB FFFF m9kefs1
6 656920 658479 780.0 KiB FFFF m9kefs2
7 786432 787991 780.0 KiB FFFF m9kefs3
8 787992 794135 3.0 MiB FFFF fsg
9 917504 920503 1.5 MiB FFFF sbl1
10 920504 923503 1.5 MiB FFFF sbl2
11 923504 927599 2.0 MiB FFFF sbl3
12 927600 937839 5.0 MiB FFFF aboot
13 937840 938863 512.0 KiB FFFF rpm
14 1048576 1081343 16.0 MiB FFFF boot
15 1179648 1180671 512.0 KiB FFFF tz
16 1180672 1180673 1024 bytes FFFF pad
17 1180674 1183673 1.5 MiB FFFF sbl2b
18 1183674 1187769 2.0 MiB FFFF sbl3b
19 1187770 1198009 5.0 MiB FFFF abootb
20 1198010 1199033 512.0 KiB FFFF rpmb
21 1199034 1200057 512.0 KiB FFFF tzb
22 1310720 3031039 840.0 MiB 8300 system
23 3031040 4177919 560.0 MiB 8300 cache
24 4194304 4196351 1024.0 KiB FFFF misc
25 4325376 4345855 10.0 MiB FFFF recovery
26 4456448 4456463 8.0 KiB FFFF DDR
27 4456464 4456479 8.0 KiB FFFF ssd
28 4456480 4456481 1024 bytes FFFF m9kefsc
29 4587520 4587583 32.0 KiB FFFF metadata
30 4718592 60424158 26.6 GiB 8300 userdata

thanks very much. If you're willing to post here, great; if you want to discuss offline, PM me?

heino69 said:

Hi roustabout,
due to the fact that I'm not sure which part of your OP step by step guide relates to 1.05 and which to 1.08 I will wait for your update.
In the meantime I prepared my PC with and unlocked the bootloader.

Everything is installed and working, so I'm ready for your instructions

Big Thanx for your work !!!

Click to expand...

Click to collapse

You're ready - the OP is updated. The CWM method using Drgravy's CWM works to root both the '05 and '08 releases.

fastboot -i 0x03F0 boot recovery.img will boot you up into Clockwork and once you choose reboot it'll offer to root for you.

very good disassembly guide

HP has a well-done document on how to take the Slate apart:

http://www.hp.com/hpinfo/globalciti...Country/disassembly_notebo_20139302303720.pdf

The illustrations are accurate. The process is very simple (to start, at least) - gently put a fingernail or pick between the glass bezel edge and the plastic at the top of the device, and work sideways until a few latches are released. Then pick one of the sides and continue gently freeing it, repeat on the other.

Now you can go back up and get the top corners of the shell off, there's enough slack.

Once that's done, the bottom can be slide off over the USB and HDMI connectors.

I did this mostly to get a look at the speakers, and found that removing the rubber strips which communicate with the outward edges of the speaker housings and then piercing the case bottom with a heated safety pin seems to give a bit more volume out.

I would recommend against piercing the speakers themselves; they actually seem to make some use of the air chambers behind the speaker membranes.

The main thing to be aware of is that in this release of Android and this configuration, few if any of the tools that are often used to try increasing volume will work - volume +, equalizers, etc. So far, most of them actually decrease volume when in use.

I'd love to hear it if anyone finds an EQ that can improve volume output.

I have xposed running now as well (now that I can remove it with CWR if needed) and it has a module that lets you wake the device with the volume rocker.

Seems to eat battery, though.

Sorry to hear that - I'd hoped that this image would help you as well.

I'm curious: when your device is in fastboot mode, what happens when you issue the commands

fastboot getvar all
or
fastboot reboot-bootloader

I'm wondering if your device is responding to the fastboot commands in full or if it's only getting a gimped set of them.

And I really wish we had access to your stock recovery image. I know there are folks who could do useful things with that.

When your device is in the stock recovery mode, it turns out you can issue a very limited set of commands usefully via ADB.

I was able to do an adb ls / and see the recovery file tree and then did an
adb pull /etc/recovery.fstab

adb shell bombs, but I was pretty interested to see I could do
adb ls /
adb ls /etc/

and so on, and then pull files once I knew what they were. I seem to remember the fellow who did the Shield root via Linux thought he could get that to work on the Slate if he had the recovery fstab - but I also think you've posted elsewhere that you don't ever get a post screen booting from that image.

My partition table's almost certainly not what you need, since I've so far only been able to get about 5 partitions going on it - boot, recovery, cache, system and data. The device is running OK but I'd really prefer to get it back to the stock layout. My memory is that there were around 12 partitions available before I hosed the gpt and sorta-kinda reestablished it.

heino69 said:

don't get me wrong, I'm happy to have my Slate 1.0.8 unlocked and rooted, but just to know:

1.) Is it possible to unroot it again?

Click to expand...

Click to collapse

Absolutely. You can unroot using SuperSU or manually just go in with an adb shell, remount /system rw and remove the su binary. If you're considering doing this before returning it for service, probably best to boot from Clockwork and actually format /system and /cache, then install the OS completely clean.

2.) Is it possible to lock the boot loader again (i.g. fastboot -i 0x03F0 oem lock)?

Click to expand...

Click to collapse

Absolutely. I don't know whether or not the device remembers it's been unlocked, though, nor whether a device return would be checked for that.

And last question:
From the past i know, that as soon as you install a CWM (i.g. with Rom Manager), the original OTA update feature from the manufacturer is broken - so this could be a good way to protect the Slate against a root lost because of updates, right?

Click to expand...

Click to collapse

I am not sure that's true in this case. How sensitive OTAs are to device configuration varies from OEM to OEM.

My rooted '05 certainly downloaded and installed the '08 update.

There is a step in the recovery script that updates the recovery partition, and that step would fail if the partition had been overwritten with CWM. I think that's the last step in the update, or the second to last, though. The stuff at the head end of the OTAs (so far) is doing a set of checks only to be sure that it's applying to the right device.

To get the OTA to apply by CWM, I deleted the checks in the updater-script, which are these:

assert(!less_than_int(1381289516, getprop("ro.build.date.utc")));
assert(getprop("ro.product.device") == "fig" ||
getprop("ro.build.product") == "fig");
assert(getprop("ro.product.name") == "kadota_w_a");

The next commands start the process of formatting. There may be pre-scripts that I didn't see that inspect recovery or update it first, I'm not sure what the order is, though.

cwm flashable '09 update

If you've rooted and installed clockwork, vanilla ota updates fail.

It's very easy to make them flashable by removing the checks.

If you use the Xposed framework, some elements of the ota that target framework files may fail silently.

My system booted fine when I was done, though. I accepted cwm's offer to re-root and to disable stock recovery.

http://www.mediafire.com/?vebsg3yxtc0vh35

is a cwm flashable 08 to 09 updater. Only use it if you're already on 08.

heino69 said:

Hi roustabout,
my rooted 08 (still with original recovery partition, no CWM mod) downloaded the 09 update today, but not installed till now.
If i install this update, i think my root will be lost again, right?
If so, can i root it again with the same trick (booting the TF 701 recovery.img) and select re-root?

Click to expand...

Click to collapse

Yes, you can. If you wanted to, you could copy my file to your device, do a
fastboot boot recovery.img with the 701 recovery, and then apply the update using CWM. As you rebooted, CWM would prompt to re-root your system.

At the same time, if you have an SD card in your system, you could make a backup with CWM's excellent backup menu. I think, but haven't tested, that CWM can both backup and restore the stock recovery - the latter would likely work best done in this sequence:

- fastboot boot CWM.img
- backup entire system or selected partitions to SD card
- reboot bootloader
- boot CWM.img
- test a restore of recovery- basically.

PS: In your OP you talking about:
-> It will also offer to disable the onboard recovery system from updating. You probably don't want to do so until
- you've backed up the recovery partition
- you've decided to install Clockwork permanently. <-

Is there a easy way to create a backup of the original recovery partition?
Currently i'm not sure if i should replace the recovery with CWM.
I only will do this, if there is a way back, and i think for a full factory restore, i will need this HP recovery partition, right?

Thanx a lot!

Click to expand...

Click to collapse

I was able to get a full restore after I'd flashed CWM. I'd hosed my system pretty thoroughly, so I flashed CWM to recovery, rebooted into it, and then did an adb sideload install of the HP system file (after editing out the file checks.)

It's been running well since I did so.

I was not able to get the HP recovery to restore my system at the point where I'd gotten it to, but then again to get my restore I needed to do a fair amount of work on repairing the partition table.